CVE-2026-120437

A flaw was found in Netpbm. The tgatoppm converter fails to validate pixel values against color map bounds in the get_pixel() function. By supplying a specially crafted color-mapped Targa file, an attacker can trigger an out-of-bounds read. This flaw can lead to a Denial of Service (DoS) through an application crash or result in information disclosure by leaking adjacent memory into the generated image.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.